Detection rules › Sublime MQL
Link: Adobe share from unsolicited sender
This attack surface reduction rule matches on messages from Adobe which were sent by an email address (as determined by the sender display name) which doesn't appear to have a relationship with the recipient organization.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Evasion |
Event coverage
Rule body MQL
type.inbound
// from Adobe Actual
and strings.icontains(sender.display_name, 'via Adobe')
and sender.email.email == 'message@adobe.com'
and headers.auth_summary.dmarc.pass
// contains a link to open or review a share
and any(body.links, .display_text =~ "open" or .display_text =~ "review")
// attempt to ensure the sender (from the sender.display_name) does NOT have a relationship with to recipient org
// not sent from a Adobe User within the org's domains
and not any($org_domains,
strings.icontains(sender.display_name,
strings.concat("@", ., ' via Adobe')
)
)
// the org has never sent a message to the address within the sender.display_name
and not any($recipient_emails, strings.istarts_with(sender.display_name, .))
Detection logic
Scope: inbound message.
This attack surface reduction rule matches on messages from Adobe which were sent by an email address (as determined by the sender display name) which doesn't appear to have a relationship with the recipient organization.
- inbound message
- sender.display_name contains 'via Adobe'
- sender.email.email is 'message@adobe.com'
- headers.auth_summary.dmarc.pass
any of
body.linkswhere any holds:- .display_text is 'open'
- .display_text is 'review'
not:
any of
$org_domainswhere:- strings.icontains(sender.display_name)
not:
any of
$recipient_emailswhere:- strings.istarts_with(sender.display_name)
Inspects: body.links, body.links[].display_text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.email, type.inbound. Sensors: strings.concat, strings.icontains, strings.istarts_with. Reference lists: $org_domains, $recipient_emails.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | via Adobe |
sender.email.email | equals | message@adobe.com |
body.links[].display_text | equals | open |
body.links[].display_text | equals | review |